69a9ab243011f95b0a1611f7d3c333eb32aee45e74613a6cddf7bcb19f51c8ab[.]bin[.]sample[.]gz

Sharing

Copy URL Twitter E-mail

General

Target

69a9ab243011f95b0a1611f7d3c333eb32aee45e74613a6cddf7bcb19f51c8ab.bin.sample.gz
Size

339KB
MD5

99e2b856db7a647f2ef66ef59e39b14a
SHA1

7fb3dbaa25c0160ace1c09784f7b0cfe01dc9011
SHA256

a19da5b91e6c597830ef4f3302569aea4433f2a61616bb387ac56f749e032af2
SHA512

5ae188924e99f5f15896a98359a73e08d0cda3258389392620747ccaded3f4c459a6811b842f9122f0019a5fce1a07c3a43389889fc262446bfed94079aa27dd
SSDEEP

6144:6ogd/IH+VgD81JSv5THynP1PiBXrmGlliIFeRtvzIQbRYZcE40X9:6TNIeOD81oBDyBwmkpFevr9bRYb40t

Score

1^/10

Malware Config

Signatures

Files

69a9ab243011f95b0a1611f7d3c333eb32aee45e74613a6cddf7bcb19f51c8ab.bin.sample.gz
.gz
sample
.dll windows x86

2fa79fa6f1ac8840cb208116ddabb6bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAIoctl
ioctlsocket
bind
listen
accept
getpeername
inet_ntoa
select
ntohs
__WSAFDIsSet
shutdown
setsockopt
recv
send
gethostname
WSAStartup
WSACleanup
closesocket
gethostbyname
connect
htons
inet_addr
socket

user32

GetMessageA
SetProcessWindowStation
OpenDesktopA
PostQuitMessage
CloseWindowStation
wsprintfA
CloseDesktop
TranslateMessage
OpenWindowStationA
CreateWindowExA
DefWindowProcA
SetThreadDesktop
DispatchMessageA
RegisterClassA
wsprintfW

kernel32

MoveFileW
FlushFileBuffers
WriteConsoleW
HeapReAlloc
LoadLibraryW
GetStringTypeW
HeapSize
RtlUnwind
LCMapStringW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
CreateFileA
SetFilePointer
WriteFile
CreateFileW
CloseHandle
Sleep
GetProcAddress
LoadLibraryA
ReadFile
GetLastError
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
CreateEventA
ResetEvent
PeekNamedPipe
GetTickCount
CreatePipe
DeleteFileW
CreateProcessA
TerminateProcess
GetStartupInfoA
InterlockedExchange
GetLocalTime
lstrcpynW
FileTimeToSystemTime
lstrcmpW
GetFileSizeEx
TlsGetValue
FindClose
RemoveDirectoryW
FileTimeToLocalFileTime
ProcessIdToSessionId
GetCurrentProcessId
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
HeapFree
HeapAlloc
GetCurrentThreadId
GetFileType
DecodePointer
GetCommandLineA
RaiseException
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc

shell32

SHGetFileInfoW

wtsapi32

WTSRegisterSessionNotification
WTSEnumerateSessionsA
WTSUnRegisterSessionNotification

ole32

CoCreateGuid

Exports

Exports

Start

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 282KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2fa79fa6f1ac8840cb208116ddabb6bf

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

user32

kernel32

shell32

wtsapi32

ole32

Exports

Exports

Sections

.text Size: 130KB - Virtual size: 130KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 282KB - Virtual size: 418KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 130KB - Virtual size: 130KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 282KB - Virtual size: 418KB

.reloc
Size: 11KB - Virtual size: 10KB